authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2025-11-24 19:45:48+01:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2025-11-24 18:45:48+00:00
log3c647ca6bb987c496652fd6bf279ef2625f41821
tree70d8cfcc1350fe9d072867638d80ebbf71d8c020
parent289f2f0d3455d2bdefb84af84075602c53a730bd
signaturebadge-check Signed by PGP key B5690EEEBB952194

crypto.ml_kem: avoid redundant assignment & fix K-PKE.KeyGen (#26031)

FIPS-203 algorithm 13 for deterministic key generation uses (𝜌, 𝜎) ← G(𝑑 ‖ 𝑘) , not (𝜌, 𝜎) ← G(k ‖ d)

1 files changed, 1 insertions(+), 2 deletions(-)

lib/std/crypto/ml_kem.zig+1-2
...@@ -376,7 +376,6 @@ fn Kyber(comptime p: Params) type {...@@ -376,7 +376,6 @@ fn Kyber(comptime p: Params) type {
376 /// Except in tests, applications should generally call `generate()` instead of this function.376 /// Except in tests, applications should generally call `generate()` instead of this function.
377 pub fn generateDeterministic(seed: [seed_length]u8) !KeyPair {377 pub fn generateDeterministic(seed: [seed_length]u8) !KeyPair {
378 var ret: KeyPair = undefined;378 var ret: KeyPair = undefined;
379 ret.secret_key.z = seed[inner_seed_length..seed_length].*;
380379
381 // Generate inner key380 // Generate inner key
382 innerKeyFromSeed(381 innerKeyFromSeed(
...@@ -507,8 +506,8 @@ fn Kyber(comptime p: Params) type {...@@ -507,8 +506,8 @@ fn Kyber(comptime p: Params) type {
507 fn innerKeyFromSeed(seed: [inner_seed_length]u8, pk: *InnerPk, sk: *InnerSk) void {506 fn innerKeyFromSeed(seed: [inner_seed_length]u8, pk: *InnerPk, sk: *InnerSk) void {
508 var expanded_seed: [64]u8 = undefined;507 var expanded_seed: [64]u8 = undefined;
509 var h = sha3.Sha3_512.init(.{});508 var h = sha3.Sha3_512.init(.{});
510 if (p.ml_kem) h.update(&[1]u8{p.k});
511 h.update(&seed);509 h.update(&seed);
510 if (p.ml_kem) h.update(&[1]u8{p.k});
512 h.final(&expanded_seed);511 h.final(&expanded_seed);
513 pk.rho = expanded_seed[0..32].*;512 pk.rho = expanded_seed[0..32].*;
514 const sigma = expanded_seed[32..64];513 const sigma = expanded_seed[32..64];